Technical Tip: FortiAnalyzer auto create default handler incident when button 'Automatically Create Incident' is disabled

[Nur]

Description	This article describes the issue when FortiAnalyzer has the custom event handler and the 'Automatically Create Incident' is enabled, and the default handler with 'Automatically Create Incident' disabled will auto-create an incident section.
Scope	FortiAnalyzer v7.6.
Solution	By default, incidents can be generated automatically by event handlers, even if no specific incidents have been manually enabled. This is due to the 'Automatically Create Incident' option being enabled by default for certain event handlers, such as those related to Outbreak Alerts. If an event handler triggers an alert, an incident is created automatically. To ensure FortiAnalyzer does not auto-create the incident in the incident section, configure the behavior under the alert setting. config system log alert get     set max-alert-count : 10000  <-- Display the number of alerts for the handlers at the incident event.     set min-severity-to-raise-incident-by-grouping: none  <-- FortiAnalyzer will not auto-generate the incident. end